A
Vendor security profile
AsyncHttpClient
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs21
Critical1
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS6.5
12-month vulnerability rate
0
0
0
0
0
0
0
0
1
0
6
14
CVE KEV
CVE severity distribution
21toplam CVE
Critical1 (5%)
High8 (38%)
Medium9 (43%)
Low3 (14%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
21Unknown
Latest vulnerabilities
6.8
CVE-2026-107226
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
A
Patch status unknownEPSS %0
5.9
CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
A
Patch status unknownEPSS %0
3.7
CVE-2026-107284
AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
A
Patch status unknownEPSS %0
3.7
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
A
Patch status unknownEPSS %0
9.4
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
A
Patch status unknownEPSS %0
7.6
CVE-2026-107281
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
A
Patch status unknownEPSS %0
6.9
CVE-2026-107280
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
A
Patch status unknownEPSS %0
8.8
CVE-2026-107279
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
A
Patch status unknownEPSS %0
7.5
CVE-2026-107232
AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
A
Patch status unknownEPSS %0
8.7
CVE-2026-107231
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
A
Patch status unknownEPSS %0